The CISA Secure by Design Pledge is a voluntary commitment by enterprise software manufacturers to make progress on seven security goals within one year. CISA states it is "voluntary and not legally binding" and that CISA does not enforce or verify adherence. It is not a certification, so describe it as a pledge.
Definitions
Pledge means a public commitment to act in good faith. Certification means an independent party tests you against a standard and issues a result. The pledge page describes the first and does not describe the second.
The seven goals
| Goal | Short description |
|---|---|
| Multi-factor authentication | Raise MFA use across products |
| Default passwords | Reduce default passwords |
| Reducing entire classes of vulnerability | Cut the prevalence of certain vulnerability classes |
| Security patches | Increase customers' installation of patches |
| Vulnerability disclosure policy | Publish a policy for good-faith security testing |
| CVEs | Report vulnerabilities transparently |
| Evidence of intrusions | Help customers gather evidence of intrusions |
Each goal begins with the commitment to "demonstrate actions taken" within one year of signing. The page says physical products such as IoT devices and consumer products are not in scope.
How suppliers should talk about it
- Say "signed the pledge" only if you did. The list is public.
- Say what you did against each goal, with dates. A signature is a starting point.
- Never write "certified," "compliant with" or "approved by CISA." The page says CISA does not verify adherence.
- Do not imply a government contract benefit. The page makes no such claim.
Why buyers ask about it
CISA's Secure by Demand guide lists "Has the manufacturer taken CISA's Secure by Design Pledge?" as a general question buyers can ask. That is a reason to have a short, accurate answer either way. If you have not signed, a clear account of which goals you already meet is better than silence. See the Secure by Demand questions.
A one paragraph template
State your status, then the facts: "We have not signed the pledge. Our disclosure policy is at this address, MFA is enforced for all administrator accounts, and we publish CVE records with CWE fields for vulnerabilities in our products." Replace each clause with what is true for you.
Quick check
Does the pledge apply to consumer products?
No. The page says physical products such as IoT devices and consumer products are not scoped in.
Does signing earn a government approval?
The page does not say so. It states the pledge is voluntary and not legally binding.
Safeguard's policies, gates and guardrails can be used to enforce checks such as dependency rules before release. You can run the free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
